Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
W3 Total Cache - Cross-Site Scripting (XSS) (CVE-2021-24436)
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
PLUGIN
W3 Total Cache
CVE-2021-24436
Risk Score
Threat Entry
Updated 2026-06-17
W3 Total Cache - Cross-Site Scripting (XSS) (CVE-2021-24427)
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
W3 Total Cache
CVE-2021-24427
Risk Score
Threat Entry
Updated 2026-06-17
W3 Total Cache - Security Vulnerability (CVE-2019-6715)
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
PLUGIN
W3 Total Cache
CVE-2019-6715
Risk Score